Commit 55a8c1b97a7 for php

commit 55a8c1b97a771d4c953c88ef3b97f943ce80fc21
Author: lazerg <lazerg2@gmail.com>
Date:   Sat Nov 7 14:49:22 2026 +0500

    Fix GH-25265: Misaligned read for virtual internal props in hooked subclass

    Closes GH-25272.

diff --git a/NEWS b/NEWS
index 5f038904389..0dd463bcdc7 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,8 @@ PHP                                                                        NEWS
     of class names in implements, catch, and trait use lists. (Jorg Sowa)
   . Fixed AST export dropping the braces of dynamic class constant fetches.
     (Jorg Sowa)
+  . Fixed bug GH-25265 (Misaligned read for virtual internal props in
+    hooked subclass). (Lazizbek Ergashev)

 - Curl:
   . Fixed curl_reset() retaining CURLOPT_PRIVATE after reset. (lacatoire)
diff --git a/Zend/tests/property_hooks/gh25265.phpt b/Zend/tests/property_hooks/gh25265.phpt
new file mode 100644
index 00000000000..64cba87c2f9
--- /dev/null
+++ b/Zend/tests/property_hooks/gh25265.phpt
@@ -0,0 +1,28 @@
+--TEST--
+GH-25265 (Hooked property in a subclass of an internal class with virtual properties)
+--CREDITS--
+YuanchengJiang
+--EXTENSIONS--
+dom
+--FILE--
+<?php
+
+class Test extends DOMDocument {
+    public int $prop { set => $value; }
+}
+
+$doc = new Test;
+$doc->prop = 42;
+var_dump(get_object_vars($doc));
+foreach ($doc as $key => $value) {
+    var_dump($key, $value);
+}
+
+?>
+--EXPECT--
+array(1) {
+  ["prop"]=>
+  int(42)
+}
+string(4) "prop"
+int(42)
diff --git a/Zend/zend_property_hooks.c b/Zend/zend_property_hooks.c
index 57e22f23ad7..bd875d579ee 100644
--- a/Zend/zend_property_hooks.c
+++ b/Zend/zend_property_hooks.c
@@ -81,6 +81,9 @@ static zend_array *zho_build_properties_ex(zend_object *zobj, bool check_access,
 			if (prop_info->flags & ZEND_ACC_STATIC) {
 				continue;
 			}
+			if (!prop_info->hooks && (prop_info->flags & ZEND_ACC_VIRTUAL)) {
+				continue;
+			}
 			zend_string *property_name = prop_info->name;
 			/* When promoting properties from protected to public, use the unmangled name to preserve order. */
 			if (prop_info->flags & ZEND_ACC_PROTECTED) {